October 2024 - openstack-discuss - lists.openstack.org

[OSSA-2024-004] OpenStack Ironic: Ironic fails to verify checksums of supplied image_source URLs when configured to convert images to raw for streaming (CVE-2024-47211)
by Jay Faulkner 03 Oct '24

03 Oct '24

==================================================================================================================================== OSSA-2024-004: Ironic fails to verify checksums of supplied image_source URLs when configured to convert images to raw for streaming ==================================================================================================================================== :Date: October 03, 2024 :CVE: CVE-2024-47211 Affects ~~~~~~~ - Ironic: <21.4.4, >=22.0.0 <23.0.3, >=23.1.0 <24.1.3, >=25.0.0, <26.1.0 Description ~~~~~~~~~~~ Julia Kreger of Red Hat noticed a vulnerability in image validation for Ironic, in which images may not have their checksum validated before conversion, potentially permitting man-in-the-middle attacks modifying image data. Patches ~~~~~~~ -https://review.opendev.org/c/openstack/ironic/+/931300 (2023.1/antelope(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931299 (2023.2/bobcat(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931295 (2024.1/caracal(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931294 (2024.2/dalmatian(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931293 (2025.1/epoxy (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931298 (Bugfix/24.0 (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931297 (Bugfix/25.0 (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931296 (Bugfix/26.0 (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931305 (Unmaintained/victoria(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931304 (Unmaintained/wallaby(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931303 (Unmaintained/xena(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931302 (Unmaintained/yoga(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931301 (Unmaintained/zed(ironic)) Credits ~~~~~~~ - Julia Kreger from Red Hat (CVE-2024-47211) References ~~~~~~~~~~ -https://launchpad.net/bugs/2076289 -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47211 Notes ~~~~~ - No other Ironic-adjacent projects, including Ironic-Python-Agent, require patching to resolve this vulnerability. - As usual, we will provide updated releases off maintained branches, but will not create new releases off bugfix or unmaintained branches. -- Jay Faulkner OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

Live Now! OpenStack 2024.2 'Dalmatian' on OpenInfra Live
by Allison Price 03 Oct '24

03 Oct '24

Hi everyone, Right now, OpenInfra Live is hosting several OpenStack PTLs as well as the chair of the Technical Committee chair from the 2024.2 Dalmatian release cycle to talk about the features from OpenStack’s 30th release. Join us on LinkedIn or YouTube and it’s live, so ask any questions you have for our guests! More information is available at openinfra.dev/live. YouTube: https://www.youtube.com/watch?v=6igJNIJ9yFE LinkedIn: https://www.linkedin.com/events/introducingopenstackdalmatian20724476314826… See you there! Allison

1 0

openstack neutron issue binding VIF
by Stepan Vakheta 03 Oct '24

03 Oct '24

Hello team, I am currently experiencing an issue with the Neutron component, specifically with port binding. I am attempting to use Neutron as an external provider for oVirt networks. I have successfully created the networks and imported them, and oVirt is able to see all the information about the network from Neutron. However, when I create a vNIC in oVirt's VM, it appears in Neutron but it shows that the binding_vif_type is "binding_failed" and the VM does not start. It seems that oVirt is not able to create the port from the imported Neutron Network. Additionally, neither the Neutron controller node nor the Neutron compute node shows any errors according to this case. I have attached the network configuration files of the controller node and the config files of the neutron component. Please let me know if there is anything else I can provide you regarding configs, logs, etc. I appreciate any help you can provide. Regards, Stepan Vakheta

1 0

OpenStack 2024.2 Dalmatian is officially released!
by Elõd Illés 02 Oct '24

02 Oct '24

Hello OpenStack community, The official OpenStack 2024.2 Dalmatian release announcement has been sent out: https://lists.openstack.org/archives/list/openstack-announce@lists.openstac… Thanks to all who were a part of the 2024.2 Dalmatian development cycle! This marks the official opening of the openstack/releases repository for 2025.1 Epoxy releases, and freezes are now lifted. stable/2024.2 is now a fully normal stable branch, and the normal stable policy applies from now on. Thanks, Előd Illés on behalf of the Release Management team

3 2

Kubernetes cluster on top of OpenStack with kops
by Jaime Ibar 01 Oct '24

01 Oct '24

Hi all, anyone is using kops for deploying a kubernetes cluster on top of Openstack? Thanks Jaime -- Jaime

2 1

[all][tc][ptl][ptg] TC Discussions at the PTG - Sign Up and Suggest Topics
by Goutham Pacha Ravi 01 Oct '24

01 Oct '24

Hello Stackers, I'd like to highlight the Technical Committee's PTG planning etherpad [1], where we're organizing our discussions for the upcoming PTG. Over the next week, I aim to finalize time slots and prioritize discussion topics. Since TC discussions are cross-project, we'll do our best to avoid scheduling conflicts with project team meetings. To help with this, I encourage all interested parties to sign up or vote on the topics listed in the etherpad. Feel free to add any additional topics you'd like to discuss as well. Thank you! Best regards, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] https://etherpad.opendev.org/p/oct2024-ptg-os-tc

1 0

[all] [security] [ptls] Please review core security teams
by Jay Faulkner 01 Oct '24

01 Oct '24

Hi all, I'm writing on behalf of the Vulnerability Management Team (VMT). We often use the ${project}-coresec teams to determine who is best to help triage initial issues. These groups do not appear to be universally up to date. If you are in charge of a repo managed by the VMT ( https://security.openstack.org/repos-overseen.html#repositories-overseen ) please ensure the associated launchpad ${project}-coresec group has active, trusted members of your community -- or otherwise reach out to the VMT in #openstack-security to arrange other contacts if needed. For example, https://launchpad.net/~ironic-coresec/+members contains four longtime Ironic cores and former PTLs. (I'll note: I likely need to audit the equivalent group for Ironic-adjacent repos, and will do that after hitting send). This is extremely important! If we can't get an issue triaged and dealt with in time, it gets opened to the public. If there's any questions, feel free to respond here or reach out in #openstack-security on OFTC. Thanks, Jay Faulkner

1 0

[ironic] Postgres CI job broken
by Julia Kreger 01 Oct '24

01 Oct '24

Greetings folks, We had a little bit of a discussion on this subject in #openstack-ironic IRC earlier today[0], but the tl;dr is it appears the postgres integration CI job Ironic has had as a "canary" of support is now failing. This time it appears to be rooted in keystone[1]. Like our prior times of raising awareness, we're sending this email to the mailing list. Given the overall deprecation of postgres support many years ago, and the decline in postgres CI jobs in OpenStack, we believe it is time for us to remove this CI job. That being said, if someone wants such support to be fixed and rejuvenated, please consider this email your call to action. Thanks, -Julia [0]: https://meetings.opendev.org/irclogs/%23openstack-ironic/%23openstack-ironi… [1]: https://7d12977942ed9fbb75e4-56d2480851ef91de1634aa83a3abd804.ssl.cf1.rackc…

2 1

[Kolla-Ansible] [Ironic] Node Deploy Failed with MissingAuthPlugin
by Ali Hussain 01 Oct '24

01 Oct '24

Hi Kolla and Ironic folks, While playing with stable/kolla release to fix the No VIF found error. Looks like adding Readers role to ironic user fixed it. But run into Missing Auth plugin [2] issue while image is being deployed to ironic node. Openstack endpoint list command [1] shows the correct IP of the controller. My question is: 1. Kolla-Ansible needs explicite Ironic keystone configuration in Ironic.conf? Following this link <https://docs.openstack.org/kolla-ansible/yoga/reference/bare-metal/ironic-g…> which does not seems to need any keystone configurations. This issue is observed when 1. --boot-interface redfish-virtual-media 2. --deploy-interface ramdisk 3. --driver-info deploy_iso= 4. -instance-info kernel & ramdisk 2. My passwords.yaml has 1. ironic_database_password: 2. ironic_inspector_database_password: 3. ironic_inspector_keystone_password: 4. ironic_keystone_password: Any suggestions please. Thank you. Ali [1] openstack endpoint list | grep ironic | <ID> | <Region> | ironic-inspector | baremetal-introspection | True | internal | http://<IP>:5050 | | <ID> | <Region> | ironic | baremetal | True | public | http://<IP>:6385 | | <ID> | <Region> | ironic-inspector | baremetal-introspection | True | public | http://<IP>:5050 | | <ID> | <Region> | ironic | baremetal | True | internal | http://<IP>:6385 [2] *Error: *Detected change in error condition on node Node1. Deploy step deploy.deploy failed with MissingAuthPlugin: An auth plugin is required to determine endpoint URL.. An unhandled exception was encountered while aborting. More information may be found in the log file.

2 6

Automating Network VLAN Reconfiguration Post-Bare Metal Provisioning with OpenStack Ironic
by Hajasolo 01 Oct '24

01 Oct '24

Hello OpenStack Community, I am currently working with OpenStack Ironic for provisioning bare metal servers and facing a specific challenge related to network security and automation. I would appreciate any insights or experiences you could share! We use Ironic to provision bare metal servers, which involves utilizing a management VLAN during the PXE boot and initial OS installation process. Post-provisioning, the server’s management interface remains accessible, posing a security risk as it can potentially access the management network. I need to ensure that once a server is provisioned and handed over to a user, it cannot access the management VLAN until it is deprovisioned. 1. How can we automate the process of removing the management VLAN from the server’s network interface post-provisioning to prevent unauthorized access to the management network? 2. Upon server deprovisioning, how can we automatically re-enable the management VLAN to allow for server re-provisioning? 3. Are there any built-in OpenStack tools or common practices within the Ironic or larger OpenStack community to handle such scenarios? Our goal is to maintain a high level of automation and self-service capability in our OpenStack environment while ensuring rigorous network security standards. Solutions that integrate seamlessly with OpenStack’s existing architecture would be ideal. Thank you for your time and help! Best regards, Haja, Joel

2 1